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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions and listings of claims in the 
application: 



1. (Canceled) 



2. (Currently Amended) A method for detecting a wireless access device on a 
network, [[said]] the method comprising: 

storing one or more organizationally unique identifiers that comprise the first 

three octets of one or more registered addresses: 
receiving from the network a packet with an address; 
searching the identifiers, wherein a more frequently encountered identifier is 

searched before a less frequently encountered identifier; 
comparing the first three octets of the received address with the identifiers ene-or 

mor e r e g i st e r e d addr e ss e s ; 
determining if the received address includes one of the stored identifiers; 
determining an operating system associated with the received address, when 

[[said]] comparing the received address results in a match between the 

received address and at least one of the registered addresses; 
comparing the determined operating system with one or more stored operating 

systems, such that at least one of the stored operating systems 

corresponds to the wireless access device; and 
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indicating that the received packet corresponds to the wireless access device 

based on the first three octets of the received address and when the 

determined operating system matches at least one of the stored operating 

systems. 

3. (Original) The method of claim 2, wherein said receiving further comprises: 
receiving the address with information identifying a source of the packet. 

4. (Original) The method of claim 3, further comprising: 

using an organizationally unique identifier as the information identifying the 
source. 

5. (Original) The method of claim 2, wherein said receiving further comprises: 
receiving the address based on passively monitoring the network. 

6. (Original) The method of claim 2, wherein comparing the address further 
comprises: 

determining whether a portion of the address is similar to a portion of at least one 
of the registered addresses. 

7. (Original) The method of claim 2, wherein comparing the address further 
comprises: 



Application No. 10/645,388 
Attorney Docket No. 03-8005 
Customer No. 25,537 

determining whether a first organizationally unique identifier of the address is 

similar to a second organizationally unique identifier of at least one of the registered 

addresses. 

8. (Original) The method of claim 2, wherein determining the operating system 
further comprises: 

determining the operating system at the Internet Protocol address associated 
with the address. 

9. (Original) The method of claim 8, wherein determining the operating system 
further comprises: 

determining the operating system using an nmap. 

10. (Original) The method of claim 2, wherein said indicating further comprises: 
indicating the wireless access device is not authorized on the network. 

1 1 . (Original) The method of claim 2, further comprising: 

storing the one or more registered addresses, such that the one or more 
registered addresses are searchable. 

12. - 15. (Canceled) 

16. (Original) The method of claim 2, further comprising: 
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storing the stored operating systems, such that a more frequently encountered 

stored operating system is searched before a less frequently encountered stored 

operating system. 



17. (Canceled) 



18. (Currently Amended) A system for detecting a wireless access device on a 
network, [[said]] the system comprising: 

means for storing one or more organizationally unique identifiers that comprise 

the first three octets of one or more registered addresses; 
means for receiving from the network a packet with an address; 
means for searching the identifiers, wherein a more frequently encountered 

identifier is searched before a less frequently encountered identifier; 
means for comparing the first three octets of the received address with the 

identifiers on e or mor e r e gist e r e d addr e ss e s ; 
means for determining if the received address includes one of the stored 

identifiers; 

means for determining an operating system associated with the received 

address, when [[said]] comparing the received address results in a match 
between the received address and at least one of the registered 
addresses; 
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means for comparing the determined operating system with one or more stored 
operating systems, such that at least one of the stored operating systems 
corresponds to the wireless access device; and 

means for indicating that the received packet corresponds to the wireless access 
device based on the first three octets of the received address and when 
the determined operating system matches at least one of the stored 
operating systems. 

19. (Currently Amended) A system for detecting a wireless access device on a 
network, [[said]] the system comprising: 
at least one memory comprising: 

code that stores one or more organizationally unique identifiers that comprise the 

first three octets of one or more registered addresses; 
code that receives from the network a packet with an address; 
code that searches the identifiers, wherein a more frequently encountered 

identifier is searched before a less frequently encountered identifier; 
code that compares the first three octets of the received address with the 

identifiers on e or mor e r e gist e red addr e ss e s ; 
code that determines if the received address includes one of the stored 

identifiers; 

code that determines an operating system associated with the received address, 
when [[said]] comparing the address results in a match between the 
received address and at least one of the registered addresses; 
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code that compares the determined operating system with one or more stored 
operating systems, such that at least one of the stored operating systems 
corresponds to the wireless access device; and 

code that indicates that the received packet corresponds to the wireless access 
device based on the first three octets of the received address and when 
the determined operating system matches at least one of the stored 
operating systems; and 

at least one data processor that executes [[said]] the code. 

20. (Original) The system of claim 19, wherein said code that receives further 
comprises: 

code that receives the address with information identifying a source of the 
packet. 

21. (Original) The system of claim 20, further comprising: 

code that uses an organizationally unique identifier as the information identifying 
the source. 

22. (Original) The system of claim 19, wherein said code that receives further 
comprises: 

code that receives the address based on passively monitoring the network. 
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23. (Original) The system of claim 19, wherein code that compares the address 
further comprises: 

code that determines whether a portion of the address is similar to a portion of at 
least one of the registered addresses. 

24. (Original) The system of claim 19, wherein said code that compares the 
address further comprises: 

code that determines whether a first organizationally unique identifier of the 
address is similar to a second organizationally unique identifier of at least one the 
registered addresses. 

25. (Original) The system of claim 19, wherein said code that determines the 
operating system further comprises: 

code that determines the operating system at the Internet Protocol address 
associated with the address. 

26. (Original) The system of claim 25, wherein said code that determines the 
operating system further comprises: 

code that determining the operating system using an nmap. 

27. (Original) The system of claim 19, wherein said code that indicates further 
comprises: 

code that indicates the wireless access device is not authorized on the network. 
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28. (Original) The system of claim 19, further comprising: 

code that stores the one or more registered addresses, such that the one or 
more registered addresses are searchable. 

29. - 32. (Canceled) 

33. (Original) The system of claim 19, further comprising: 

code that stores the stored operating systems, such that a more frequently 
encountered stored operating system is searched before a less frequently encountered 
stored operating system. 

34. (Currently Amended) A computer program product , tangibly embodied in a 
computer-readable storage medium, for detecting a wireless access device on a 
network, the computer program product comprising: 

code that stores one or more organizationally unigue identifiers that comprise the 
first three octets of one or more registered addresses: 

code that receives from the network a packet with an address; 

code that searches the identifiers, wherein a more freguently encountered 
identifier is searched before a less freguently encountered identifier: 

code that compares the first three octets of the received address with the 
identifiers on e or mor e r e gistered addresses : 
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code that determines if the received address includes one of the stored 

identifiers: 

code that determines an operating system associated with the received address. 

when [[said]] comparing the address results in a match between the 

received address and at least one of the registered addresses; 
code that compares the determined operating system with one or more stored 

operating systems, such that at least one of the stored operating systems 

corresponds to the wireless access device; and 
code that indicates that the received packet corresponds to the wireless access 

device based on the first three octets of the received address and when 

the determined operating system matches at least one of the stored 

operating systems; and 
at least one data processor that executes [[said]] the code. 

35. (Original) The computer program product of claim 34, wherein said code that 
receives further comprises: 

code that receives the address with information identifying a source of the 
packet. 

36. (Original) The computer program product of claim 35, further comprising: 
code that uses an organizationally unique identifier as the information identifying the 
source. 
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37. (Original) The computer program product of claim 34, wherein said code that 
receives further comprises: 

code that receives the address based on passively monitoring the network. 

38. (Original) The computer program product of claim 34, wherein code that 
compares the address further comprises: 

code that determines whether a portion of the address is similar to a portion of at 
least one of the registered addresses. 

39. (Original) The computer program product of claim 34, wherein said code that 
compares the address further comprises: 

code that determines whether a first organizationally unique identifier of the 
address is similar to a second organizationally unique identifier of at least one of the 
registered addresses. 

40. (Original) The computer program product of claim 34, wherein said code that 
determines the operating system further comprises: 

code that determines the operating system at the Internet Protocol address 
associated with the address. 

41. (Original) The computer program product of claim 34, wherein said code that 
determines the operating system further comprises: 

code that determines the operating system using an nmap. 
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42. (Original) The computer program product of claim 34, wherein said code that 
indicates further comprises: 

code that indicates the wireless access device is not authorized on the network. 

43. (Original) The computer program product of claim 34, further comprising: 
code that stores the one or more registered addresses, such that the one or 

more registered addresses are searchable. 

44. - 47. (Canceled) 

48. (Original) The computer program product of claim 34, further comprising: 
code that stores the stored operating systems, such that a more frequently 

encountered stored operating system is searched before a less frequently encountered 
stored operating system. 

49. (Currently Amended) A system comprising: 
a network; and 

a processor connected to the network, wh e r e in th e proc e ssor r e ceives on e or 
more packets, with an addr e ss, from th o n e twork, the processor further 
comprising: 

means for storing one or more organizationally unique identifiers that 

comprise the first three octets of one or more registered addresses: 
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means for receiving a packet with an address from a wireless access 

device on the network; 
means for searching the identifiers, wherein a more frequently 

encountered identifier is searched before a less frequently 

encountered identifier; 
means for comparing the first three octets of the received address with the 

identifiers; 

means for determining if the received address includes one of the stored 
identifiers; 

means for determining an operating system associated with the received 
address, when comparing the received address results in a match 
between the received address and at least one of the registered 
addresses; 

means for comparing the determined operating system with one or more 
stored operating systems, such that at least one of the stored 
operating systems corresponds to the wireless access device; and 

means for indicating that the received packet corresponds to the wireless 
access device based on the first three octets of the received 
address and when the determined operating system matches at 
least one of the stored operating systems 

means for d e t e rmining an op e rating syst e m associated with at l e ast on e of 
th e pack e ts, wh e n a n Organizationa ll y U ni qu e I d e ntif ie r inc l ud e d in 
the at least o n e pack e t r e pr e s e nts a wir ele ss acc e ss d e vic e ; 
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m e ans for comparing th o d e t e rmin e d op e rating syst e m w i th 



wir e less 



d e vic e op e rat i ng syst e ms; and 



for in d ica t i ng that the a t l east 



pack e t 



■ ponds to th e 



wirslss? 



d e vic e bas e d 



th e first thr e e oct e ts of th e 



address and wh o n th e det e rm i n e d op e rating syst e m matches at 



le ast 



of th e w i r ele ss 



d e vic e op e rat i ng syst e ms . 



50. (Currently Amended) A system comprising: 
a network; 

a first processor interfaced to the network; and 

a second processor interfaced to the network, wherein the second processor: 
stores one or more organizationally unique identifiers that comprise the 

first three octets of one or more registered addresses; 
receives a packet with an address from the first processor via the network; 
searches the identifiers, wherein a more frequently encountered identifier 

is searched before a less frequently encountered identifier; 
compares the first three octets of the received address with the identifiers; 
determines if the received address includes one of the stored identifiers; 
determines an operating system associated with the received address, 

when comparing the received address results in a match between 

the received address and at least one of the registered addresses; 
compares the determined operating system with one or more stored 

operating systems, such that at least one of the stored operating 
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systems corresponds to an operating system of the first processor; 

and 

indicates that the first processor corresponds to a wireless access device 
based on the first three octets of the received address and when 
the determined operating system matches at least one of the stored 
operating systems 

indicating that th e f i rst proc e ssor corresponds to a wire l ess acc e ss device 
bas e d on th e first thre e oct e ts of th o addr e ss of the first proc e ssor 
and on an op e rating syst e m of th e f i rst proc e ssor . 

51. (Canceled). 

52. (Currently Amended) A computer program product, tangibly embodied in a 
computer-readable storage medium, for detecting a wireless access device on a 
network and containing instructions which, when executed on a processor, perform a 
method comprising: 

storing one or more organizationally unigue identifiers that comprise the first 

three octets of one or more registered addresses; 
receiving from the network a packet with an address; 
searching the identifiers, wherein a more freguently encountered identifier is 

searched before a less freguently encountered identifier; 
comparing the first three octets of the received address with the identifiers; 
determining if the received address includes one of the stored identifiers; 
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determining an operating system associated with the received address, when 

comparing the received address results in a match between the received 

address and at least one of the registered addresses; 
comparing the determined operating system with one or more stored operating 

systems, such that at least one of the stored operating systems 

corresponds to the wireless access device; and 
indicating that the received packet corresponds to the wireless access device 

based on the first three octets of the received address and when the 

determined operating system matches at least one of the stored operating 

systems 

r e c e iv in g, from th e network, a packet with an addr e ss; and 

i ndicati n g that th e r e c e iv e d pack e t corr e sponds to th e wir e l e ss acc e ss d e v i c e 

bas e d on th o f i rst thr ee oct e ts of th e addr e ss and on an op e rating system - 

associat e d w i th th e rec ei v e d pack e t . 
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